Carl Weinschenk spoke with Mark Fullbrook, director for the UK and Ireland, Cyber-Ark, about a Cyber-Ark survey on administrative privileges and the dangers they can create. The survey found that about a third of IT personnel   queried admitted to using their administrative privileges to access data that they shouldn't.

Weinschenk: What did the survey show?
Fullbrook: Essentially, it was a survey conducted at The Infosecurity Europe exhibition at the end of April. We asked a series of questions concerning administrative privileges, what senior people did with those privileges, and how they interacted with sensitive information. The primary thing that came out of that survey was the very interesting fact that about one-third answered affirmatively to the question: “Have you ever used administrative privileges to access information not relevant to your role?”

Weinschenk: That’s a frightening result.
Fullbrook: A lot of people around the blogosphere picked up on that. ZDNet Europe asked a question along the same lines and 34 percent of 450 responders said yes. That backs up our responses. We asked about the prevalence of industrial espionage in the organization. There were some interesting results of that. When we asked people whether they are aware of what we would call people deliberately taking data outside the organization, we saw some interesting results. We will use that in a future press release. [All I’ll say is] if it was a very low number, we wouldn’t have been interested.

Weinschenk: Have you done anything like this before?
Fullbrook: We had a similar survey a couple of times before. The reason for the survey is to get publicity around this massive problem. I think there is a consistent downward trend, due to the increased uptake of technology to manage the issue. It is driven by things like SOX and HIPAA, which covers how you deal with privileged information.

Weinschenk: Was the survey just European?
Fullbrook: It was European, no U.S. input, but the cross section of companies is global. So it had IT administrators of some of the biggest companies in the world. I would say it’s absolutely a global phenomenon.

Weinschenk: Budgets are strapped. Does this problem absolutely require investment or are there other ways to approach it?
Fullbrook: Can you control this type of access without investing in technology? Yes, you can change passwords, you can use physical safes and put passwords in them and make people ask for them. You can do it with these and other procedures.

Previous Page Next Page